USN473-1 : libgd2 vulnerabilities
|
|
Article ID: 28074
Last updated: 27 Jan, 2009
|
|
|
|
Views: 355
|
|
Posted: 22 Jan, 2009
by: Tech Pubs S.
Updated: 27 Jan, 2009
by: Tech Pubs S.
|
|
USN473-1 : libgd2 vulnerabilities |
|
| Ubuntu Security Notice (C) 2007 Canonical, Inc. / NASL script (C) 2007 Tenable Network Security, Inc. |
|
|
| Family | Ubuntu Local Security Checks |
| Plugin ID | 28074 |
| Bugtraq ID |
|
| CVE ID | CVE-2007-0455
CVE-2007-2756
|
|
| Description: |
Synopsis :
These remote packages are missing security patches :
- libgd-tools
- libgd2
- libgd2-dev
- libgd2-noxpm
- libgd2-noxpm-dev
- libgd2-xpm
- libgd2-xpm-dev
Description :
A buffer overflow was discovered in libgd2s font renderer. By tricking
an application using libgd2 into rendering a specially crafted string
with a JIS encoded font, a remote attacker could read heap memory or
crash the application, leading to a denial of service. (CVE-2007-0455)
Xavier Roche discovered that libgd2 did not correctly validate PNG
callback results. If an application were tricked into processing a
specially crafted PNG image, it would monopolize CPU resources. Since
libgd2 is often used in PHP and Perl web applications, this could lead
to a remote denial of service. (CVE-2007-2756)
Solution :
Upgrade to :
- libgd-tools-2.0.33-4ubuntu2.1 (Ubuntu 6.10)
- libgd2-2.0.33-2ubuntu5.2 (Ubuntu 6.06)
- libgd2-dev-2.0.33-2ubuntu5.2 (Ubuntu 6.06)
- libgd2-noxpm-2.0.33-4ubuntu2.1 (Ubuntu 6.10)
- libgd2-noxpm-dev-2.0.33-4ubuntu2.1 (Ubuntu 6.10)
- libgd2-xpm-2.0.33-4ubuntu2.1 (Ubuntu 6.10)
- libgd2-xpm-dev-2.0.33-4ubuntu2.1 (Ubuntu 6.10)
Risk factor : High
|
|
